Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

itwbennett sends us a few links from IT World tracing a story about infected microSD cards in Vodaphone-supplied mobile phones. "The original report came on March 8 after an employee of Panda Security plugged a newly ordered HTC Magic phone from Vodafone into a Windows computer, where it triggered an alert from the antivirus software. Further inspection of the phone found the device's 8GB microSD memory card was infected with a client for the now-defunct Mariposa botnet, the Conficker worm, and a password stealer for the Lineage game. At that point it was at thought to be an issue with a specific refurbished phone. On Wednesday another phone surfaced with traces of the Mariposa botnet. And now Vodafone is saying that as many as 3,000 HTC Magic phones may be affected."

this wasn't software downloaded from the internet for the phone, it appears the card was infected before it was put into the phone. the code wouldn't even execute on the phone, only if you plugged the phone into your computer and mounted the sd card. thus the walled garden wouldn't protect you and is completely unrelated.

Why would an SD card come anywhere near a PC during the manufacturing process? Aren't they fabricated in large batches, not unlike RAM or CPUs? The only part of the process that I would think might involve a PC would be the formating at the end. Yet it seems like they'd have a dedicated hardware device that formats multiple chips at a time.

I would strongly suspect that(for reasons of economics) the "dedicated hardware device" that formats multiple chips at the same time is based on a commodity PC, probably running XP, running some hacked-together program for doing the formatting and testing.

The only real question is whether the hardware interface between the commodity PC components and the large number of SD cards is something fairly custom, or basically just a whole lot of USB SD card readers mounted in some sort of frame. A specialized i

Is stuff like this malicious? Like someone at the memory card plant put the virus executables on the hardware? Or is it just a case of the worker having an infected computer, which then infected the memory cards?

In the one case I'm familiar with, which was at another company, the infection was traced to a single PC on the production floor that was just *packed* with malware. Apparently, it had been re-purposed from somebody's desk to the QA station when production capacity was expanded.

No, it SHOULD be SOP. It should be trivial, but I haven't been in a single business where it actually was SOP. I'm not saying that there are not businesses that do it right, but you don't get to look like a hero fixing computer problems if there are no computer problems to fix.

>>>"Democracy is the pathetic belief in the wisdom of collective ignorance." -- H.L. Mencken

Actually studies have found that when you take a mob of people, and have them make guesses, they often come-up with the right answer. For example, ask an audience to guess how many jellybeans are in a jar, average their answers, and you'll have the correct answer +/- 1 jellybean.

BACK TO TOPIC:

What good is an 8 gigabyte RAM card? You can't even run Windows 95 on that?

"This configuration was distinctly suboptimal for any productive use..... if any networking or similar components were installed the system would refuse to boot with 4 megabytes of RAM. To achieve optimal performance, Microsoft recommends an Intel 80486 or compatible microprocessor with at least 8 MB of RAM."

Apparently even back then Microsoft was taking the ACTUAL requirements, and dividing them in half, like when they claimed Vista would work on 1/2 gig of RAM when it clearly could not.

From TFA:With the first phone, the Mariposa botnet code automatically ran and attempted to infect a computer. Mariposa was at one time one of the largest botnets, but security researchers were able to shut it down in December after disabling its command-and-control servers

It's a Windows malware, right? So a "Windows" computer connect to the phones sdcard and attempts to autorun whatever on it.I don't see how the malware can somehow activated and affect Android Linux O/S running on ARM chip inside a user-mod

From TFA:
With the first phone, the Mariposa botnet code automatically ran and attempted to infect a computer. Mariposa was at one time one of the largest botnets, but security researchers were able to shut it down in December after disabling its command-and-control servers

It's a Windows malware, right? So a "Windows" computer connect to the phones sdcard and attempts to autorun whatever on it.
I don't see how the malware can somehow activated and affect Android Linux O/S running on ARM chip inside a user-mode VM.
Do botnets have legs now?

It's irrelevant what operating system the malware operates on. The fact that malware came pre-loaded is troubling.

Can I just say it's amazing that Lineage is still popular enough in Asian countries that people are stealing passwords for it like this. If only it held on in the US... that game gave me so many lovely hours of punching ents.

What would be the simplest, easiest, cellphone with the least functionality (no bluetooth, no Java, no appstore, no memory card) that would fit me?

You know, one with ten numbers and a "call" and a "hang up" button?

You say you want "simplest and easiest". Think deeply about what you're trying to do. Do you actually want to talk to a "number", or do you really intend to talk to a specific person? This is a real question, and not intended to be a smart-assed comment.

Most people assume a simple phone is one that dials numbers, but that's because we've been trained by 80 years of technological limits that have forced us to abstract human conversations behind strings of digits. With new phones that have contact lists,

``Admittedly anyone running a *nix based computer would not have had a problem with this malware.''

I can't help but wonder "how long?"

How long until we *nix users start having to bog down our systems in order to slow the flood of malware that would otherwise corrupt them?

Given that viruses and other malware have been a fact of life for as long as I've been using PCs (i.e. early '90s), and that they have never been an issue for Mac or Linux, even in the days when Macs were nearly as numerous as PCs, I'm inclined to say that day will never come.

What's more likely is that -just like Unix/Linux did- Windows will ultimately drag itself out of the morass of insecurity in which it's currently mired. Eventually....

This comes as no surprise to me and I remember thinking when i saw console systems such as the Dreamcast go online how long will it be before these systems act as gateways for malware as they continue to make devices more networkable. Now days with all the major consoles and smart phones online and tethiered to your PC it seems more dangerous than ever. How many of you have anti virus for your Playstation 3 , Xbox 360, WII, Iphone, or Droid?

Holy crap, that's a lot more phones than I last read.
And the Mariposa botnet isn't completely out of the picture. It may be old, but it's still a possible threat, especially if someone has access to phone cards.